9 ms·
Welcome to the Cloud - "Your Apple ID has been disabled."
- RexRollman 15y ago"We'll never see this fixed until Gruber gets the error." Awesome.
- 13r4v0 15y agowho is gruber.. Forgive me for being naive..
- molecule 15y agortfa. http://daringfireball.net/colophon/ http://daringfireball.net/colophon/
- 13r4v0 15y agoHw the f am i supposed to know that John Gruber is an apple fan boy by reading his About page.. it
- Timothee 15y agoTo be more verbose than molecule: Gruber is an Apple-focused blogger who gained a lot of influence in the Apple world over time. A lot of people interested in the Apple "world" follow his blog. So, if he were to get this problem and blog about it, Apple would make sure it'd be fixed fast…
- ugh 15y agoI very much doubt that assertion. Gruber complains quite a bit, I can’t recognize any pattern of Apple fixing specifically the problems he has faster.
- Groxx 15y agoSupporting evidence: the lack of Markdown support in the Mail app
- BlazingFrog 15y agoOr on Apple discussion forums.
- Timothee 15y agoFair enough. I don't have any evidence either way to be honest, I was mostly explaining why he was mentioned in the post. Though, in any case, one thing you can be sure of is that when he blogs about something, it gets significant attention in the tech sphere. You wouldn't be able to link a fix directly to him afterwards, but I think it's fair to say that his blow-horn is loud enough to have some influence.
- Pewpewarrows 15y agoIt's result #2 in a Google search for "Gruber".
- monochromatic 15y agoDude, the word "Gruber" is a hyperlink in the article. Just click on it.
- mcantor 15y agoWhere on Gruber's website is his relevance to the subject made clear? EDIT: No, seriously. If someone has no idea who Gruber is and they click through to his site, tell me where on the screen they would see information that answers the implicit question "Who is Gruber and why would him finding out about this problem aid its resolution".
- monochromatic 15y agoYou're right. It's not like the title of his page is "Gruber: Mac Fanboy #1" I retract my snark, or at least a little bit of it.
- mcantor 15y agoDuly upvoted! I appreciate your willingness to keep an open mind.
- deleted 15y ago[deleted]
- mkramlich 15y agoDaring Fireball blog author Google "Gruber Apple" is your friend.
- jschuur 15y agoAre there examples of things that were fixed by Apple specifically because Gruber blogged about it?
- chc 15y agoBack when there was all the controversy about really stupid and occasionally offensive App Store rejections, Gruber took the rare approach of actually criticizing Apple on his blog. So Apple VP Phil Schiller personally responded to Gruber's latest post and Apple began making some sweeping changes to their review processes.
- technoslut 15y agoWell Gruber did give his reply to this story: http://daringfireball.net/linked/2011/08/12/itunes-account-hacked http://daringfireball.net/linked/2011/08/12/itunes-account-h...
- sprovoost 15y ago> In Hanselman’s case, though, he admits he was using PayPal, > not a credit card. Perhaps it’s therefore safer to use a > credit card instead of PayPal for iTunes Store payments? I don't see how that makes a difference if your iTunes account is compromised. Or perhaps it's because your creditcard company is more likely than Paypal to alert you to suspicious activity?
- DannoHung 15y agoHe's just saying that there's an extra authentication step. Which wouldn't do him jack-all if he had a keylogger on his computer.
- cmsj 15y agoNote the comment about credit card security codes. This dude is all the way hacked.
- shanselman 15y agoNo, there are no credit cards attached to my account. The commenter is mistaken. I also haven't received an emailed receipt so I suspect a larger backend hack. My systems are secure.
- robflynn 15y agoIn my compromise I did receive e-mail receipts. Interesting.
- shadowfiend 15y agoDepending on when this happened, keep in mind that Apple often delays receipt emails for up to a day (in my experience) and bundles the purchases of that day into one receipt. So again, depending on when it happened, you may simply not have received the receipt yet.
- shanselman 15y agoGood to know. Thanks!
- shanselman 15y agoIronically, the receipt JUST showed up now.
- jschuur 15y agoSince there's no credit card associated, it couldn't have asked you to verify you via the CVV in an automated way, so perhaps it skipped this extra security step that other account holders have.
- 15y ago
- robflynn 15y agoSomething similar happened to me a while back. I noticed that several smiley face/emoticon applications had been downloaded using my account. They removed my credit card from my account and drained my iTunes gift card. Apple caught the problem and e-mailed me to ask if it was me. I told them no. They disabled my account, refunded the gift card money, and asked me to write them once I was satisfied that my computer was secure (just in case it was key-logged [I was not].) I wrote them back the next day and told them everything was good to go. They enabled my account and I signed in and changed my password. I didn't lose any of my purchased items and I could have had the account back the same day had I chosen to. I recall a while back that there were quite a few iTunes accounts that had been compromised. I used a very non-trivial password, too, so I'm rather surprised that mine was one of the compromised accounts. I'm still curious as to how it happened.
- jobu 15y agoI've only made multi-item purchases from iTunes a few times, but every time I've gotten a call from my credit card company within a couple hours. The last time they said that it's become so common for fraudulent activity on a card to start with a "run on iTunes", then move on to other online sites if the card still works. The only thing I would recommend to Scott Hansleman is to drop PayPal. They can be easier for small donations online, but with how far behind the curve they are in consumer fraud protection I refuse to make purchases with paypal anymore.
- sprovoost 15y agoThere's a difference between someone using your creditcard to buy stuff on iTunes with a different iTunes account* and someone using your iTunes account to buy apps. In your case I'm guessing they did the first thing. * = possibly not their own; they might own the apps that you're buying or make money through affiliate networks. And of course they could buy gift cards with your cards and sell them on eBay through another payment account.
- ajross 15y agoNo doubt because you reused the non-trivial password and someone read it out of a stolen database. Password strength is a red herring. Password reuse is a far bigger problem then weak passwords.
- oflannabhra 15y agoNot to be un-empathetic here, but I'm more intrigued by the exploit vector than Apple's initial response to an individual. It's interesting that your account is getting exploited without the password being hacked. Does anyone have more details?
- troymc 15y agoThat was my question too: How, exactly (technically), did this happen?
- Steko 15y agoSpoilers: his password got hacked.
- shanselman 15y agoMust be via reuse, as they lock out after the third fail. My concern is that it was a site-unique password.
- reemrevnivek 15y agoI got that same email yesterday when I purchased Lion for a computer on which I'd replaced the logic board. The "change your password" suggestion and lack of a fraud reporting mechanism was strange, but I didn't have cause to tell anyone. Also, the "do_not_reply@apple.com" seems like a strange address for an email like this. It should be "fraud@apple.com" (note: probably doesn't exist) or at least provide a link to the list of phone numbers at http://support.apple.com/kb/HE57 http://support.apple.com/kb/HE57 or the online support system at https://expresslane.apple.com/ https://expresslane.apple.com/. Unfortunately, the conclusion of this rather long thread: https://discussions.apple.com/thread/2178698?start=0&tstart=0 https://discussions.apple.com/thread/2178698?start=0&tst... seems to be that Apple isn't legally liable for this, and that you need to take it up with your bank.
- Aqua_Geek 15y agoI think this issue is orthogonal from the one mentioned on the discussion board. My understanding is that the user on the board is complaining about someone stealing his card number and using it to buy stuff on iTunes via the hacker's own account; the OP is complaining about somebody using the OP's iTunes account (and possibly his PayPal account?) to buy things on iTunes. It sounds to me like the developer of the app purchased might be in on this - there are apparently multiple reviews saying that the same thing happened to other people. Or maybe said hacker(s) just like playing that particular game? Edit: I completely agree that do_not_reply is the wrong address from which an email like this should be coming.
- taylorbuley 15y agoI can see how a data lockdown would be offputting, but I read this as a story about how some algo at Apple stopped a thief from stealing as much as he could have otherwise. One of the main gripes seems to be that Apple "let this happen" -- but enabling app commerce is what they do. Someone gets ahold of your credit line, they go buy stuff. Best Buy doesn't "let it happen", neither does Visa. After the fact they are just mandated to limit the damage to which you're responsible. I'm not sure I could tolerate it any other way. Personally, I would not enjoy a system where some human calls me up every time I make an app purchase. I feel Apple's sin of omission is forgivable here and see it as laudable that some software algo that stopped it after $40 bucks or so. I'll be interested to read, however, whether or not Apple holds this gentleman accountable for those purchases and whether or not they fallback onto the credit card provider for damage limits.
- shanselman 15y agoOK, let's make this a movement. Tell me your stories: http://myappleidhasbeendisabled.tumblr.com http://myappleidhasbeendisabled.tumblr.com
- pheroku 15y agoIs this paid for by your employer, Microsoft or are you just doing this for fun? Apologies for the blunt question, but you've often run anti-Google, anti-Apple stories and are well known as a 'kept blogger'.
- deleted 15y ago[deleted]
- bgentry 15y agoYou effing fanbois? This post doesn't contribute positively to the discussion, and doesn't address the actual question raised by the parent as to the OP's motivation for creating his blog.
- sumitkm 15y agoOkay, maybe swearing was bad on my part. I've deleted my comment. I still find the question 'offensive' because 1. Scott created the blog with the stated intent of people sharing their experience with account hacking in iTunes. 2. Mr. Pheroku question that reeks of fanboism and is downright insulting. So you should probably downranking the question too.
- chadgeidel 15y agoScott is one of the rare biased, objective posters in the blogging world. He never tries to hide his love of Microsoft and its products, however he never makes unfounded, baseless accusations and always backs up his claims with real data. Consider these posts in recent history: http://www.hanselman.com/blog/ReviewMicrosoftTouchMouseForWindows7.aspx http://www.hanselman.com/blog/ReviewMicrosoftTouchMouseForWi... (critical of MS hardware) http://www.hanselman.com/blog/HackersCanKillDiabeticsWithInsulinPumpsFromAHalfMileAwayUmNoFactsVsJournalisticFearMongering.aspx http://www.hanselman.com/blog/HackersCanKillDiabeticsWithIns... (well-researched article) http://www.hanselman.com/blog/RequestForCommentsIssuesWithNETAndMicrosoftProductVersioning.aspx http://www.hanselman.com/blog/RequestForCommentsIssuesWithNE... (a common question raised among .Net developers)
- AllenKids 15y agoI don't know why he is blaming apple for the security measure. It could be apple's fault that he was hacked, it could be otherwise. Still apple only knew there was a new device using his account, legit or not it didn't know for sure. I have at least 9 iDevices hooked up to my account as of late, on average 3 more each year. And I don't think apple can do much more to validate each and every one of them without being intrusive and annoying.
- shanselman 15y agoI am blaming Apple for: * the fact they "allow the purchase first" and "warn later." * their warning email has no fraud or dispute mechanism * I've never purchased a game like this so they my usage pattern should be a red flag Apple should have fraud systems as powerful and convenient as VISAs.
- AllenKids 15y agoI can sympathize with you. But even suspect credit fraud is also "purchase first" "warn later". Refusing to let a new device purchase anything without a thorough check is a ridiculous idea. But I do agree that as the iTunes store grows, the anti-fraud mechanism should be vastly improved along the way. IIRC Apple just began to send those emails out to remind costumers of suspicious activity due to rampant credit card theft. Clearly Apple hasn't done enough to minimize users effort and loss. I'm skeptical of utilizing usage pattern though, App Store genius recommendation is laughable.
- Splines 15y agoI can sympathize with you. But even suspect credit fraud is also "purchase first" "warn later". Refusing to let a new device purchase anything without a thorough check is a ridiculous idea. They could always do something like what Steam does - the first time you try to buy something with a new device, you must enable it by typing in a code that is emailed to you. Apple's new-device-detection algorithm doesn't seem to be perfect - I was vacationing and bought an app, and it was flagged as a new device (I got the mail for my purchase), despite it being the same one I've been using for a few years.
- YooLi 15y agoI removed my credit card from iTunes a while ago when the first of the "my iTunes account has been stolen" stories was breaking. I just fill the account with iTunes gift cards instead. It's a minor inconvenience to have to keep track of how much gift card credit there is, but the cards are available everywhere in the US (gas stations, Walmart, Walgreens, CVS, etc.) If the account ever does somehow get compromised, the most I lose is the $30 or so I keep in gift card credit.
- troymc 15y agoI don't have an iOS device, but I do use iTunes on my Mac and Windows desktops. About a month ago, I wanted to rent a movie on iTunes (as a test), but my iTunes balance was $0, so I tried to figure out how to tell iTunes my credit card information. I couldn't find any way to do that. Maybe it's not possible? It was frustrating but my solution was just to buy a $15 iTunes gift card when I was grocery shopping at Safeway. After reading this story, I'm glad I couldn't give my credit card information to iTunes.
- Splines 15y agoYou probably are even less interested in adding your credit card, but if you want, there's a "Payment Information" section if you click on the "Account" button dropdown by your apple id in iTunes. I just changed my password to one more unique (I was reusing it elsewhere), and finding the place to do so was surprisingly hard to find (IMO, it's harder than adding payment information).
- dasil003 15y agoSince this apparently came from China, has anyone considered the possibility that it could be an inside exploit?
- glhaynes 15y agoWhile Apple's hardware is built in China, iTunes and the App Store are not.
- dasil003 15y agoSo you don't think hardware knowledge could provide vectors for software exploits?
- psykotic 15y agoCould you give a realistic scenario for the present case? Safari exploit that installs a keylogger on the victim's iOS device? It seems much more likely someone was hit by an exploit on their desktop machine with iTunes installed.
- alexyoung 15y agoThere seems to be other people talking about unauthorised purchases: https://discussions.apple.com/thread/3031164?start=45&tstart=0 https://discussions.apple.com/thread/3031164?start=45&ts...
- garron 15y agoMaybe Apple will have to add a 2-step verification like Google.
- sprovoost 15y agoBased on his story, I would guess that: 1 - someone got their hands on Apple's private encryption keys 2 - some got their hands on a list of Apple id's or device UDID's 3 - Apple knows this, but wants to fix the problem behind the scenes and keep it under the radar. My memory of Apple's in App Purchase system is a bit rusty, but my guess is a combination of 1 and 2 is enough to cheat it into buying products on someone else's behalf. Then again, it could also just be a reused password.
- shanselman 15y agoIf it was a reused password, I'm an idiot. But, I'm willing to assume I am an idiot. My point is two-fold: 1. Allowing new devices to buy stuff without two-factor auth is weak sauce. 2. The larger meta-point that when we rely on the cloud in a big way, it hurts when we are locked out.
- sprovoost 15y agoIf someone tried to buy an app "manually" using their own device and your account, they would need to know your email address and password. There's plenty websites out there that store password in plain text, some of them even email it to you so everyone can intercept it. Other sites use some encryption, but could be still be compromised. The possibility I hinted at is that someone just "pretends" they have an iPhone and communicate with the Apple server directly. I don't know how their algoritm works, but it may be the case that they only need an Apple id and some secret key that is stored on the device. In that case asking the user for their password is just a way to protect the user when they lose their actual device. That would be pretty insecure from Apple's side. They should at least use the password to generate a key pair. (This doesn't necessarily require anyone to steal secret keys from Apple I just realize) I completely agree with your second more general point. See also my comment on the Paypal thread: http://news.ycombinator.com/item?id=2880194 http://news.ycombinator.com/item?id=2880194
- sprovoost 15y agoIt's interesting to look at the companies that are mentioned. Pearl-in-palm is based in Beijing and has been around for seven years [0]. They make games and this one gets great ratings on the English store [1]. But very bad ratings on the Japanese store [2], saying things Google translates as "Amount has been exploited to gain unauthorized access". Based on this and on anto1ne's comment about Chinese "gift cards" [3], my guess is that the company is legit and that someone sells iTunes usernames passwords to individual gamers looking for extra points. There's another company mentioned in these discussions: Kamagame Poker. In fact, if you Google "Kamagame poker chip" the first two hits are people on Apple forums complaining about unauthorized charges. Same phenoma as above: great reviews in the US store, bad reviews in the Japanse store. Perhaps the Japanese are not interested in these two games, so a larger percentage of their downloads are scam related, while in the US the majority of downloads is legitimate? So here's an opportunity for some automated detective work: 1 - scrape all applications with in app purchases 2 - scrape US and Japanese reviews 3 - look for rating differentials (and of course terms like 'fraud', 'charge') Follow up with more manual labor: 1 - where are most of the customers of these apps? (China?) 2 - are these companies related? (I have no reason to suspect these two, but the bigger picture might look different) [0] http://investing.businessweek.com/research/stocks/private/snapshot.asp?privcapId=28536716 http://investing.businessweek.com/research/stocks/private/sn... [1] http://itunes.apple.com/en/app/id428912410?mt=8 http://itunes.apple.com/en/app/id428912410?mt=8 [2] http://itunes.apple.com/en/app/id428912410?mt=8 http://itunes.apple.com/en/app/id428912410?mt=8 [3] http://news.ycombinator.com/item?id=2879423 http://news.ycombinator.com/item?id=2879423
- jonknee 15y agoI had a friend receive an email thanking him for his gift card purchase (that he didn't make). Even more strange, it was a different name and not on his credit card, but apparently from his account. There's a ton of iTunes Store fraud out there.
- radicalbyte 15y agoGiven Apple's security practises are more Microsoft-2001 than Microsoft-2011, I'd hazard a guess that there's some sort of 0-day exploit hitting iOS devices themselves. Scott's not dumb though to fly without antivirus/firewalls on his own PCs. Your iPad/iPhone, on the other hand, are almost certainly running no antivirus and no firewall. Because who needs such inconveniences, eh?
- m0nastic 15y agoApple's security practices for Mac OS X could arguably be described historically as Microsoft-2006 (Lion would seem to be approaching Microsoft-2011), but to conflate that with IOS's security practices is disingenuous. Here's a fairly recent presentation outlining some of the security practices around IOS 4: http://trailofbits.com/2011/08/10/ios-4-security-evaluation/ http://trailofbits.com/2011/08/10/ios-4-security-evaluation/
- anto1ne 15y agoWell, his account was probably sold in china, it's common (at least it still was a few months ago) on taobao (the chinese ebay), they sell you "gift cards" to be used within 12h after purchase, it's in fact accounts. I guess that's why Apple started to ask CCV for purchases. There's also a practice in China to use apps as a kind of fraud, or maybe money laundering. I've seen once a chinese wallpaper app, with each wallpaper for sale at $99, making thousands on the appstore.. when you think about it, it's easy to post an wallpaper app, set the price, and you get money through Apple, without any traces. What I really hate about all this is that Apple still force you (or make it very difficult not to) to have a CC linked to your itunes account, even though you plan to never buy anything.
- shanselman 15y agoThis seems plausible, but I don't use the same passsword between sites. Hm...
- jsz0 15y agoHow would Apple know about a new iOS device or Mac signing into your iTunes Store account? It learns of the device the first time you successfully login on the device. Besides doing some sort of pre-registration or requiring an iTunes Store ID to simply buy the device there's no easy way around that. They'd also have to end all used/third party sales of Apple products or require resellers to activate every iPad, iPod Touch, iPhone and Mac they're sold. It's completely unrealistic to do a default deny on new devices.
- sprovoost 15y agoThey could do something similar to what Facebook does: as soon as they detect a new device using your account, send an email. If the new device is not in the same country as your other devices, don't allow purchases until you've clicked on that link in your email.
- stingraycharles 15y agoAnd don't forget to ensure that you can't change your email unless you're doing it from an authorized device. Otherwise a malicious person could just change the email address where the notification emails are going to.
- deleted 15y ago[deleted]
- DannoHung 15y agoI'm confused about something here: This guy gets an email about his account being accessed illegally, and the email's got some problems with it in how it presents the info, okay, sure, Apple should get right on it. Then we jump to some stuff about his AppleID being disabled? What?